CVE-2026-16538 in Wallet for WooCommerce Plugin
Summary
by MITRE • 08/12/2026
The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability in the Wallet for WooCommerce WordPress plugin affects versions prior to 1.6.10 and represents a critical financial integrity flaw that enables unauthorized wallet top-ups with insufficient payment amounts. This issue stems from inadequate input validation and transaction verification mechanisms within the plugin's payment processing workflow, where the system fails to cross-check the actual payment received against the intended top-up amount before crediting customer wallets. The flaw creates a scenario where malicious actors or even honest customers who mistakenly underpay can manipulate their wallet balances by receiving credit for amounts that were never fully paid.
The technical implementation of this vulnerability exposes a fundamental security gap in the plugin's transaction handling logic, which operates without proper payment verification procedures typically expected in financial systems. When users initiate wallet top-ups through WooCommerce, the plugin should validate that the payment amount matches or exceeds the requested top-up value before updating the customer's wallet balance. However, the absence of this validation allows for arbitrary credit entries that can be exploited to accumulate funds beyond what was actually paid. This weakness directly violates security principles related to financial transaction integrity and can be categorized under CWE-20: Improper Input Validation, which encompasses insufficient verification of input data before processing. The vulnerability also aligns with ATT&CK technique T1078.004: Valid Accounts, as it enables unauthorized financial manipulation through legitimate user accounts.
The operational impact of this vulnerability extends beyond simple financial loss, potentially enabling more sophisticated attack vectors such as account manipulation, fraud schemes, and revenue leakage that can significantly affect both merchants and consumers. Attackers could systematically underpay for wallet top-ups to accumulate free credits while the system fails to detect the discrepancy, creating a potential revenue drain for businesses relying on this payment mechanism. The flaw affects all users of affected plugin versions, making it particularly dangerous as it can be exploited by anyone with access to the wallet functionality without requiring specialized attack tools or techniques.
Mitigation strategies should focus on implementing robust transaction validation mechanisms that verify actual payment amounts against requested top-up values before credit allocation occurs. Plugin developers should enforce proper input sanitization and validation checks, ensuring that all payment transactions undergo verification before wallet balance updates are committed. Organizations using this plugin should immediately update to version 1.6.10 or later, while implementing additional monitoring controls to detect anomalous transaction patterns that might indicate exploitation attempts. Security measures should include transaction logging with amount discrepancy alerts, automated validation checks for payment-to-top-up ratios, and regular audits of wallet balance changes to identify unauthorized modifications. The vulnerability demonstrates the critical importance of proper financial transaction validation in e-commerce platforms and highlights the need for comprehensive security testing of payment processing components within WordPress plugins.